Filebeat config for nginx logs

Elastic Stack Beats
2

Hi @aarishramesh,

You are defining only 1 prospector, when you write the second paths field, the previous one gets overriden. Check https://www.elastic.co/guide/en/beats/filebeat/5.4/configuration-filebeat-options.html for a good example.

In your case I would do something like:

- input_type: log
  paths:
    - /var/log/nginx/access.log
  document_type: nginx-access

- input_type: log
  paths:
    - /var/log/nginx/error.log
  document_type: nginx-error

Let me know if that works for you!